Skip to content

Home

Jump to bottom
Thierry Delamare edited this page Mar 29, 2019 · 5 revisions

Table of Contents

What are we doing

We capture SSH sessions using sudo

  • To allow session audit logging
  • To avoid the disruption of non transparent bastion

How do we implement session audit logging

We didn't found a simple and standard tool to fulfill this need (see Links).

Among the various way to capture SSH sessions to allow session audit logging we choose the way of sudosh (Sudo Shell is a wrapper to run a login shell with sudo for the purpose of session audit logging) from cloudposse.

See the sudosh README for explanations.

We made a simplified sudosh.py version of main.go and implement the usage directives via this role.

Using ansible ar-sudosh role and user-sudosh.yml play we deploy the session audit logging for all users on all nodes (specified from global configuration in private repo)

That amount (more or less) to some simple steps

  • Copy sudosh.py in /usr/local/bin/sudosh

  • Change loging shell of users to whatever it was (typically /bin/bash) to /usr/local/bin/sudosh

  • Add a sudosh group and add users to the group

  • Add a sudo rule

     %sudosh ALL=(%sudosh) ALL
 Defaults: %sudosh log_input, log_output, iolog_dir=/space/var/log/sudo-io, logfile=/space/var/log/sudo.log
 Defaults> %sudosh !requiretty

  • Remove setuid bit from chsh(1)

Is this a bastion ?

No. The sudosh setup is installed on all nodes

What does the activation of sudosh means for you ?

  • All your SSH sessions will be logged
  • All the input, output and tty io of your SSH session will be logged
  • All your keeped session (no expiration policy is defined yet) can be replayed (using timing information) via sudoreplay(8)

Examples

Using ssh node whil result in something like that going into log, all tty input into ttyin, all tty output in ttyout and the timing information into timing.

1553878191:user:user::/dev/pts/6:24:80
/home/user
/bin/bash -l

Using ssh node cmd will result in something like that going into log and the output into stdout (and to stderr if any)

1553878409:user:user::unknown:24:80
/home/user
/bin/bash -c cmd

Warning

Because all IO are logged.

  • if, once logged, you do cat giga-dump.sql the giga-dump.sql file will be store in session data file ttyout.

  • if you do cat giga-log.txt | ssh node wc, the giga-log.txt file will be store in session data file stdin

  • if you do ssh node cat giga-log.txt | grep error, the giga-log.txt file will be store in session data file stdout

These examples are rather silly (while the first one could happen accidentaly), but you get the picture, please be carefull.

Clone this wiki locally